Use similarity hashes to find potentially related samples

malwaredb_similar_files.sql

select sha1_a, sha1_b, ssdeep_sim, lzjd_sim, tlsh_sim
from (
    select
        fileA.sha1 as sha1_a,
        fileB.sha1 as sha1_b,
        fuzzy_hash_compare(fileA.ssdeep, fileB.ssdeep) as ssdeep_sim,
        lzjd_compare(fileA.lzjd, fileB.lzjd) as lzjd_sim,
        tlsh_compare(fileA.tlsh, fileB.tlsh) as tlsh_sim
    from file as fileA
    join file as fileB on fileA.id != fileB.id
) sims
where ssdeep_sim > 20 or lzjd_sim > 20
   or (tlsh_sim < 100 and tlsh_sim > 0)